[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Some SWID Tag Resources

Thanks Dave.  I incorporated it into the Vulnerability related 
standards and efforts doc.

Thank you, Gracias, Grazie,  谢谢, Merci!, Спасибо!, Danke!, ありがとう, 
Kent Landfield

On 12/14/17, 9:21 AM, "owner-cve-editorial-board-list@lists.mitre.org 
on behalf of Waltermire, David A. (Fed)" 
<owner-cve-editorial-board-list@lists.mitre.org on behalf of 
david.waltermire@nist.gov> wrote:

    Here are some software identification (SWID) tag resources:
    - Some general resources: https://scap.nist.gov/specifications/swid/
    - NISTIR 8060 provides an overview of the capabilities and usage of 
SWID tags. It also provides requirements for SWID tags that enable 
various cybersecurity use cases.
    - There is the CoSWID draft nearing completion in the IETF which 
defines an alternate serialization to the SWID tag XML format to 
support devices that may require a smaller tag footprint.
    - NIST has produced a Java-based command-line SWID tag validator 
based on NISTIR 8060 and ISO/IEC 19770-2:2015. This tool can also be 
invoked by API. I plan to open source the tool and the Decima library 
which provides the validation functionality.
    https://scap.nist.gov/specifications/swid/ (under "SWID Tag 
Validation Tool")

Page Last Updated or Reviewed: December 22, 2017